默认情况下,FreeBSD是不支持root用户的SSH远程访问的,如果你一定要这么连接,你将会遇到如下所示的样子的错误告警:
或者这样的错误:
[root@redis python]# ssh 192.168.92.171 Password for root@freebsd: Password for root@freebsd: Password for root@freebsd: Permission denied (publickey,keyboard-interactive). [root@redis python]#
如果遇到了这样的问题,你需要对FreeBSD的SSHD做出配置上的修改:
修改后,我的配置文件【/etc/ssh/sshd_config】的状态是这样的:
root@freebsd:~ # cat /etc/ssh/sshd_config # $OpenBSD: sshd_config,v 1.98 2016/02/17 05:29:04 djm Exp $ # $FreeBSD: releng/11.0/crypto/openssh/sshd_config 296633 2016-03-11 00:15:29Z des $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. # Note that some of FreeBSD's defaults differ from OpenBSD's, and # FreeBSD has a few additional options. #Port 22 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: # The default requires explicit activation of protocol 1 #Protocol 2 # HostKey for protocol version 1 #HostKey /etc/ssh/ssh_host_key # HostKeys for protocol version 2 #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key # Lifetime and size of ephemeral version 1 server key #KeyRegenerationInterval 1h #ServerKeyBits 1024 # Ciphers and keying #RekeyLimit default none # Logging # obsoletes QuietMode and FascistLogging #SyslogFacility AUTH #LogLevel INFO # Authentication: #LoginGraceTime 2m #PermitRootLogin no #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 #RSAAuthentication yes #PubkeyAuthentication yes # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 #AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 #AuthorizedPrincipalsFile none #AuthorizedKeysCommand none #AuthorizedKeysCommandUser nobody # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #RhostsRSAAuthentication no # similar for protocol version 2 #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # RhostsRSAAuthentication and HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # Change to yes to enable built-in password authentication. #PasswordAuthentication no #PermitEmptyPasswords no # Change to no to disable PAM authentication #ChallengeResponseAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes # Set this to 'no' to disable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. #UsePAM yes #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no #X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no #UsePrivilegeSeparation sandbox #PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS yes #PidFile /var/run/sshd.pid #MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none #VersionAddendum FreeBSD-20160310 # no default banner path #Banner none # override default of no subsystems Subsystem sftp /usr/libexec/sftp-server # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server # adamhuan changed PasswordAuthentication yes PermitRootLogin yes root@freebsd:~ #
而其中关键的位置,在这里:
root@freebsd:~ # cat /etc/ssh/sshd_config | grep --color -E "PermitRootLogin|PasswordAuthentication|PermitEmptyPasswords" #PermitRootLogin no #PasswordAuthentication no #PermitEmptyPasswords no # PasswordAuthentication. Depending on your PAM configuration, # the setting of "PermitRootLogin without-password". # PAM authentication, then enable this but set PasswordAuthentication PasswordAuthentication yes PermitRootLogin yes root@freebsd:~ #
具体意思:
PermitRootLogin,是否允许root登录
PermitEmptyPassword,是否允许空密码登录
PasswordAuthentication,是否使用口令验证
————————
另外,FreeBSD中的SSH服务可能也不是默认打开的,你可以按照下面的方式去启用。
查看服务是否运行:
root@freebsd:~ # service sshd status sshd is running as pid 785. root@freebsd:~ #
查看端口的监听状态:
root@freebsd:~ # netstat -an | grep --color 22 tcp4 0 0 192.168.92.171.22 192.168.92.1.4765 ESTABLISHED tcp4 0 0 *.22 *.* LISTEN tcp6 0 0 *.22 *.* LISTEN root@freebsd:~ #
查看是否激活了SSH服务:
root@freebsd:~ # cat /etc/rc.conf hostname="freebsd" ifconfig_em0="DHCP" ifconfig_em0_ipv6="inet6 accept_rtadv" sshd_enable="YES" # Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable dumpdev="AUTO" root@freebsd:~ # root@freebsd:~ # cat /etc/rc.conf | grep --color ssh sshd_enable="YES" root@freebsd:~ #
除了上面这些,还有一个地方记录了与SSH有关的信息:
root@freebsd:~ # cat /etc/inetd.conf | grep --color ssh #ssh stream tcp nowait root /usr/sbin/sshd sshd -i -4 #ssh stream tcp6 nowait root /usr/sbin/sshd sshd -i -6 root@freebsd:~ #
——————————
这样,完成了上述配置之后,用root用户ssh登录FreeBSD就应该没有问题了:
[root@redis python]# ssh 192.168.92.171 Password for root@freebsd: Last login: Fri May 26 16:55:45 2017 from 192.168.92.1 FreeBSD 11.0-RELEASE-p1 (GENERIC) #0 r306420: Thu Sep 29 01:43:23 UTC 2016 Welcome to FreeBSD! Release Notes, Errata: https://www.FreeBSD.org/releases/ Security Advisories: https://www.FreeBSD.org/security/ FreeBSD Handbook: https://www.FreeBSD.org/handbook/ FreeBSD FAQ: https://www.FreeBSD.org/faq/ Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/ FreeBSD Forums: https://forums.FreeBSD.org/ Documents installed with the system are in the /usr/local/share/doc/freebsd/ directory, or can be installed later with: pkg install en-freebsd-doc For other languages, replace "en" with a language code like de or fr. Show the version of FreeBSD installed: freebsd-version ; uname -a Please include that output and any error messages when posting questions. Introduction to manual pages: man man FreeBSD directory layout: man hier Edit /etc/motd to change this login announcement. root@freebsd:~ # root@freebsd:~ # exit logout Connection to 192.168.92.171 closed. [root@redis python]#
——————————————————
Done。